In short
- The app contains no advertising or analytics tools. We do not track you across apps or websites.
- We do not sell your data or share it with anyone for advertising.
- We never ask for your location, contacts, photos or advertising identifier.
- You can delete your account in the app: Profile → Delete account.
Who is responsible
Puzzle Flora is developed and published by Abdullah Darçın, an individual developer, who is the data controller.
For any privacy question or request: hello@excfy.com
Data we process
| Data | When | Why |
|---|---|---|
| Guest user ID (a random number) | When you finish your first level, even without an account | To link your progress, rewards and purchases to you on our server |
| Email address and password | If you register with email | Sign-in, account verification and password reset. Your password is never stored in plain text |
| Sign in with Apple: email (may be Apple's private relay address) and name | If you sign in with Apple | Sign-in. Only your first name is used, and only if you have no display name yet |
| Apple refresh token | If you sign in with Apple | To revoke the app's access to your Apple account when you delete your account |
| Google sign-in: email and name | If you sign in with Google | Sign-in. Only your first name is used |
| Display name and preset avatar | When you set them in your profile | To show you in rankings, leagues and cups |
| Country | Suggested from your device's region setting when you open the rankings. No GPS or IP lookup. You can change it | Country rankings |
| Game data: level progress, words found, game sessions, coin, gem and tool transactions, quests, streaks, league and cup results, garden layout, cloud save | As you play | To run the game, keep your progress across devices, grant rewards correctly and prevent cheating |
| Purchase records: product, transaction number, date, amount, refund status | When you make an in-app purchase | To verify purchases, deliver items and handle refunds. We never see your card details; Apple processes the payment |
| Technical security logs (IP address, session time) | On sign-in and server requests | Kept by our infrastructure provider to prevent abuse and keep the service secure |
Data that stays on your device
Your settings, a local copy of your progress for offline play and caches stay on your device. Session keys are stored in the iOS Keychain. Deleting the app removes them.
What we don't collect
We don't collect your location (GPS), contacts, photos, microphone, advertising identifier (IDFA) or device identifiers. The app contains no advertising or analytics software and never asks for tracking permission.
Purposes and legal bases
- Providing the game, managing your account and progress, delivering purchased items: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c).
- Preventing cheating and abuse, securing the service, keeping leagues and rankings fair: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5/2-f).
- Keeping purchase and refund records: legal obligations and the establishment or defence of legal claims (GDPR Art. 6(1)(c) and (f); KVKK Art. 5/2-ç and 5/2-e).
Data is collected automatically through the app and our servers. It is not used for anything else, and we don't send marketing emails.
What other players see
Once you have an account, other players can see the following in rankings, leagues and cups: your display name (or a default such as “Bahçıvan #1234”), your preset avatar, your country and your score. Your email address and surname are never shown. Guest accounts don't appear in rankings.
You can change your display name in Profile. We may change names that harass others or contain personal information.
Who we share data with
We only share data with service providers that help us run the game, and only as much as they need:
| Provider | Purpose | Data |
|---|---|---|
| Supabase Inc. | Server, database and authentication infrastructure | All server-side data listed above |
| RevenueCat Inc. | Validating and managing in-app purchases | Your user ID and purchase records |
| Apple Inc. | App Store payments, Sign in with Apple, Game Center | Payments and sign-in happen in Apple's own services. If you use Game Center, your scores and achievements are sent to Apple; your Game Center ID never reaches us |
| Google LLC | Sign in with Google | Sign-in happens in Google's own service |
We may also disclose data to authorities where required by law. Otherwise we never sell, rent or give away your data for advertising.
International transfers
Supabase, RevenueCat, Apple and Google operate servers outside Türkiye and, depending on where you live, outside your country. Your data is therefore transferred abroad so we can provide the game. Transfers are made under the conditions and safeguards required by KVKK Article 9 and, where applicable, the GDPR (such as the European Commission's Standard Contractual Clauses).
How long we keep data
| Data | Period |
|---|---|
| Account, profile, progress, wallet and purchased items | Until you delete your account |
| Guest accounts | Deleted automatically after 90 days without use. Guest accounts with a purchase, a linked sign-in method or progress past level 30 are not removed by this clean-up |
| Detailed game history (quests, daily rewards, visit logs) | 35 days |
| League and cup details | Between 56 and 182 days; afterwards only medal counts remain |
| Older cloud save copies | 35 days (the latest 20 copies are kept) |
| Purchase event records sent by the store | 400 days. Kept for refunds and disputes even if you delete your account; the link to your account is removed, but the record still contains the user ID number the store used. Deleted when the period ends |
Deleting your account and data
In the app, go to Profile → Delete account (Profil → Hesabı sil) and type “SİL” to confirm. Your account and all server data linked to it are deleted immediately and permanently, except the purchase event records described above. If you signed in with Apple, the app's access to your Apple account is revoked as well.
If you can't access the app or played as a guest, follow the steps on the account deletion page.
Your rights
Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Under KVKK Article 11 you may also learn whether your data is processed, for what purpose, and to whom it is transferred, and claim compensation for unlawful processing.
Send your request from your account email address to hello@excfy.com. We reply free of charge within 30 days. You also have the right to complain to your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK).
Children
Puzzle Flora is a word game players of all ages can enjoy, but it is not directed at children. We don't knowingly ask children under 13 for contact details such as an email address. If you believe a child has given us such information, write to hello@excfy.com and we will delete it.
Security
All connections between the app and our servers are encrypted (HTTPS). Session keys are kept in your device's secure storage. Our database enforces row-level access rules, so each player can only reach their own data. Rewards and purchases are verified on the server.
This website
This website uses no cookies, analytics or tracking tools; fonts and images are served from the site itself. Cloudflare, which hosts the site, may briefly process technical information such as your IP address to deliver the site and protect it against attacks.
Changes
When we add a feature or service to the game, we update this policy and the date at the top of this page. If a change requires your consent, we will ask for it in the app.
Contact
Abdullah Darçın
Email: hello@excfy.com